CVE-2025-58465lowCWE-79

CVE-2025-58465: falha de baixa gravidade em QNAP Systems Inc. Download Station

Download Station

Publicada em

Seguir esta CVE+ Monitorar Download Station

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

8Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 2.2epss 0.2%
A cross-site scripting (XSS) vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, they can then exploit the vulnerability to bypass security mechanisms or read application data. We have already fixed the vulnerability in the following versions: Download Station 5.10.0.305 ( 2025/09/16 ) and later Download Station 5.10.0.304 ( 2025/09/08 ) and later
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:U
Produtos afetados
QNAP Systems Inc. · Download Station
CVEs relacionadas — QNAP Systems Inc. Download Station

No mesmo produto, das mais perigosas para as menos.

CVE-2025-58463LOWDownload StationEPSS 0.5%CVE-2026-39993HIGHPath Traversal to Root RCE in QNAP Download Station via Addon/Search addon ParameterEPSS 0.4%CVE-2026-39989MEDIUMSSRF in QNAP Download StationEPSS 0.3%CVE-2024-38640HIGHDownload StationEPSS 0.2%CVE-2026-34014HIGHds-move-files.sh is writable and executed as rootEPSS 0.1%